higgsfield-recipes

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use curl to download generated media assets from remote URLs and save them to the local filesystem (e.g., brands/<slug>/assets/). This is a documented functional requirement for maintaining offline-deterministic builds for landing pages.
  • [PROMPT_INJECTION]: Prompt templates in prompts.md utilize variable interpolation (e.g., {{name}}, {{pitch}}, {{saas.jtbd}}) to customize generation. While these ingestion points could theoretically be used for indirect prompt injection to influence the visual output, the surface is limited to generative model parameters.
  • Ingestion points: Variable placeholders in prompts.md (e.g., {{name}}, {{pitch}}).
  • Boundary markers: None; variables are placed directly within the natural language prompt bodies.
  • Capability inventory: Includes file-system writing and curl command execution in SKILL.md.
  • Sanitization: No explicit sanitization logic is present, but the instructions emphasize strict adherence to specified model parameters and output types.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 05:36 PM